Splunk Search

How to Join IP with CIDR?

kiran331
Builder

Hi

I'm trying to Compare the IP with CIDR Lookup to get the result.In the Lookup i got the CIDR range, City, manager.

Data in lookup:

IP Country Manager
10.21.22.23/24 US abc

Search I'm using:

index=.....|table dest_ip|join type=left dest_ip[|inputlookup range.csv|rename IP as dest_ip]|table dest_ip city Manager

Tags (2)
0 Karma

sundareshr
Legend

Look at this answer. Setup match_type = CIDR(IP) in the transforms for your lookup file

https://answers.splunk.com/answers/5916/using-cidr-in-a-lookup-table.html

0 Karma

kiran331
Builder

Thanks for the response! I added this to transforms.conf.
[range]
filename = range.csv
max_matches = 1
min_matches = 1
default_match = OK
match_type = CIDR(IP)

But when i try to search, its showing errors.

search:
index=...|lookup range IP as dest_Ip OUTPUT Manager|table dest_ip Manager

0 Karma

niddhi
Explorer

I also have the same settings in transform.conf, but its not matching the results. What am i missing here? Any pointers are appreciated.

Thanks,

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...